Unicode Right-To-Left override (U+202E) displaces text to the right terminal edge #3381

Closed
opened 2026-01-30 23:20:00 +00:00 by claunia · 3 comments
Owner

Originally created by @jantari on GitHub (Aug 12, 2019).

Environment

Windows build number: 10.0.18956.1000
Windows Terminal version (if applicable): 0.3.2171.0

Steps to reproduce

  1. Create a file with the Unicode Right-To-Left override character in its name, such as harmless_file[U+202E]txt.exe
  2. Display this files name in the Terminal by running dir /b in cmd or ls in PowerShell etc.

Expected behavior

  • The files name should appear as harmless_fileexe.txt

Actual behavior

-The files name appears as:

harmless_file                                                                                                 exe.txt

Screenshot comparing Windows Terminal, conhost and File Explorer:
unicode_rtl_windows_terminal

Originally created by @jantari on GitHub (Aug 12, 2019). <!-- 🚨🚨🚨🚨🚨🚨🚨🚨🚨🚨 I ACKNOWLEDGE THE FOLLOWING BEFORE PROCEEDING: 1. If I delete this entire template and go my own path, the core team may close my issue without further explanation or engagement. 2. If I list multiple bugs/concerns in this one issue, the core team may close my issue without further explanation or engagement. 3. If I write an issue that has many duplicates, the core team may close my issue without further explanation or engagement (and without necessarily spending time to find the exact duplicate ID number). 4. If I leave the title incomplete when filing the issue, the core team may close my issue without further explanation or engagement. 5. If I file something completely blank in the body, the core team may close my issue without further explanation or engagement. All good? Then proceed! --> <!-- This bug tracker is monitored by Windows Terminal development team and other technical folks. **Important: When reporting BSODs or security issues, DO NOT attach memory dumps, logs, or traces to Github issues**. Instead, send dumps/traces to secure@microsoft.com, referencing this GitHub issue. If this is an application crash, please also provide a Feedback Hub submission link so we can find your diagnostic data on the backend. Use the category "Apps > Windows Terminal (Preview)" and choose "Share My Feedback" after submission to get the link. Please use this form and describe your issue, concisely but precisely, with as much detail as possible. --> # Environment ```none Windows build number: 10.0.18956.1000 Windows Terminal version (if applicable): 0.3.2171.0 ``` # Steps to reproduce 1. Create a file with the [Unicode Right-To-Left override](http://www.unicode-symbol.com/u/202E.html) character in its name, such as `harmless_file[U+202E]txt.exe` 2. Display this files name in the Terminal by running `dir /b` in cmd or `ls` in PowerShell etc. # Expected behavior - The files name should appear as `harmless_fileexe.txt` # Actual behavior -The files name appears as: harmless_file &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; exe.txt Screenshot comparing Windows Terminal, conhost and File Explorer: ![unicode_rtl_windows_terminal](https://user-images.githubusercontent.com/25607767/62881122-50e7ec80-bd2f-11e9-9dd0-83bd246e70bc.png)
Author
Owner

@egmontkob commented on GitHub (Aug 12, 2019):

Note: It's unfortunate that both txt and exe are palindromes, so it's hard to spot that txt.exe should (and does) render as exe.txt (the exact reverse order), it just shouldn't be aligned to the right.

BiDi should IMO be implemented according to https://terminal-wg.pages.freedesktop.org/bidi/, whereas in its default (implicit) mode RLO would indeed work as you describe it. (There's work to be done in the specification to properly track BiDi controls, including at the beginning of a line.)

BiDi is a great source for all kinds of unexpected attacks (as I suspect you were playing with it), making an exe file look like a txt or the other way around. Probably dir or ls could filter out BiDi control characters, but that's another story.

@egmontkob commented on GitHub (Aug 12, 2019): Note: It's unfortunate that both `txt` and `exe` are palindromes, so it's hard to spot that `txt.exe` should (and does) render as `exe.txt` (the exact reverse order), it just shouldn't be aligned to the right. BiDi should IMO be implemented according to https://terminal-wg.pages.freedesktop.org/bidi/, whereas in its default (implicit) mode RLO would indeed work as you describe it. (There's work to be done in the specification to properly track BiDi controls, including at the beginning of a line.) BiDi is a great source for all kinds of unexpected attacks (as I suspect you were playing with it), making an `exe` file look like a `txt` or the other way around. Probably `dir` or `ls` could filter out BiDi control characters, but that's another story.
Author
Owner

@jantari commented on GitHub (Aug 12, 2019):

Oh yea sorry for the bad example, you're right.

Basically:

harmless_file[U+202E]fdp.bat

would come out as:

harmless_filetab.pdf

It does kinda mess with your brain, especially when you put multiple [U+202E] in a file name.
Since browsers support Unicode, this works right on GitHub too of course:

harmless_file‮fdp.bat

@jantari commented on GitHub (Aug 12, 2019): Oh yea sorry for the bad example, you're right. Basically: harmless_file[U+202E]fdp.bat would come out as: harmless_filetab.pdf It does kinda mess with your brain, especially when you put multiple [U+202E] in a file name. Since browsers support Unicode, this works right on GitHub too of course: harmless_file‮fdp.bat
Author
Owner

@DHowett commented on GitHub (Jul 22, 2025):

We no longer reorder text when we encounter U+202E.

@DHowett commented on GitHub (Jul 22, 2025): We no longer reorder text when we encounter U+202E.
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/terminal#3381